file upload completed
This commit is contained in:
marcos.luna
@@ -26,6 +26,7 @@
|
||||
- [Artifacts Support](#artifacts-support)
|
||||
- [Credentials Support](#credentials-support)
|
||||
- [File Downloads Support](#file-downloads-support)
|
||||
- [File Uploads Support](#file-uploads-support)
|
||||
- [Development](#development)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
- [Credits](#credits)
|
||||
@@ -183,6 +184,7 @@ For more information, see the [Mythic documentation on customizing public agents
|
||||
| `rm` | Delete file or directory | `rm C:\temp\file.txt` |
|
||||
| `cat` | Read file contents (with automatic credential detection) | `cat C:\path\to\file.txt` |
|
||||
| `download` | Download file from target to Mythic server | `download C:\path\to\file.txt` |
|
||||
| `upload` | Upload file from Mythic server to target | `upload <file> C:\path\to\destination.txt` |
|
||||
|
||||
### Execution & Control
|
||||
|
||||
@@ -561,6 +563,7 @@ Currently supported:
|
||||
- **File Write**: Automatically reported for:
|
||||
- `cp` (copy) - reports destination file path
|
||||
- `mkdir` (create directory) - reports created directory path
|
||||
- `upload` - reports destination file path when uploading files
|
||||
- **File Delete**: Automatically reported for:
|
||||
- `rm` (delete) - reports deleted file/directory path
|
||||
- **File Read**: Automatically reported for:
|
||||
@@ -573,7 +576,6 @@ Currently supported:
|
||||
- `cat` - read-only file operation (doesn't create artifacts, but may report credentials)
|
||||
|
||||
Future support can be added for:
|
||||
- **File Write**: For file upload operations (e.g., `upload` command)
|
||||
- **Network Connection**: When network operations occur (e.g., for `socks` proxy connections)
|
||||
- **Registry Modification**: When registry keys are modified (e.g., `reg_set`, `reg_delete`)
|
||||
- **Process Inject**: When processes are injected into (e.g., `inject` command)
|
||||
@@ -610,6 +612,7 @@ Example implementations:
|
||||
- `shell`: Process Create artifact with command
|
||||
- `cp`: File Write artifact with destination path
|
||||
- `mkdir`: File Write artifact with directory path
|
||||
- `upload`: File Write artifact with destination file path
|
||||
- `rm`: File Delete artifact with deleted path
|
||||
- `download`: File Read artifact with downloaded file path
|
||||
|
||||
@@ -882,6 +885,112 @@ For more information, see the [Mythic File Downloads documentation](https://docs
|
||||
|
||||
---
|
||||
|
||||
## 📤 File Uploads Support
|
||||
|
||||
Cazalla supports uploading files from the Mythic server to the target using chunked transfers, following [Mythic's File Upload specification](https://docs.mythic-c2.net/customizing/hooking-features/action-upload).
|
||||
|
||||
### Features
|
||||
|
||||
- **Chunked File Transfers**: Large files are automatically split into chunks (512KB default) for efficient transfer
|
||||
- **Automatic Path Normalization**: Automatically handles path formatting (normalizes double backslashes)
|
||||
- **Smart Path Handling**: Automatically appends filename when path is a directory
|
||||
- **Progress Tracking**: Mythic tracks upload progress (chunks sent/total chunks)
|
||||
- **File Write Artifacts**: Automatically reports File Write artifacts when files are uploaded
|
||||
|
||||
### How It Works
|
||||
|
||||
1. **Command Execution**: When you execute `upload <file> C:\path\to\destination.txt`, the agent:
|
||||
- Receives the `file_id` and destination path from Mythic
|
||||
- Normalizes the destination path (handles double backslashes, directories, etc.)
|
||||
- Creates the destination file
|
||||
- Requests file chunks from Mythic sequentially
|
||||
- Receives base64-encoded chunk data from Mythic
|
||||
- Decodes and writes chunks to the destination file
|
||||
- Reports a File Write artifact when complete
|
||||
|
||||
2. **Mythic Integration**: The upload is automatically:
|
||||
- Tracked with progress in Mythic's UI
|
||||
- Registered as a File Write artifact
|
||||
- Visible in Mythic's Artifacts page
|
||||
|
||||
### Using the Upload Command
|
||||
|
||||
```bash
|
||||
# Upload a file to the target
|
||||
# Select file from Mythic UI file selector, then specify destination path
|
||||
upload <file> C:\Users\localuser\Downloads\file.txt
|
||||
|
||||
# Uploads are chunked automatically - Mythic will show progress
|
||||
```
|
||||
|
||||
### Upload Process
|
||||
|
||||
1. **Request**: Agent sends upload request to Mythic for each chunk:
|
||||
- `file_id`: Unique identifier for the file to upload
|
||||
- `chunk_num`: Automatically incremented (1, 2, 3, ...)
|
||||
- `chunk_size`: Size requested per chunk (512KB default)
|
||||
- `full_path`: Destination path on the target
|
||||
|
||||
2. **Response**: Mythic responds with chunk data:
|
||||
- `total_chunks`: Total number of chunks for the file
|
||||
- `chunk_num`: Current chunk number
|
||||
- `chunk_data`: Base64-encoded chunk data
|
||||
|
||||
3. **Writing**: Agent decodes and writes each chunk sequentially
|
||||
|
||||
4. **Completion**: Once all chunks are received and written, the file is complete
|
||||
|
||||
### Example Upload Flow
|
||||
|
||||
```
|
||||
Mythic: Task created with file_id and path
|
||||
Agent: [upload] Iniciando upload: C:\Users\file.txt (2 chunks)
|
||||
Agent: [upload] Solicitando chunk requesting chunk 1
|
||||
Mythic: Response with chunk 1/2 (512KB base64 data)
|
||||
Agent: [upload] Chunk 1/2 escrito: 512000 bytes
|
||||
Agent: [upload] Solicitando chunk requesting chunk 2
|
||||
Mythic: Response with chunk 2/2 (512KB base64 data)
|
||||
Agent: [upload] Chunk 2/2 escrito: 512000 bytes
|
||||
Agent: [upload] Upload completado: C:\Users\file.txt (1024000 bytes)
|
||||
Mythic: File Write artifact created
|
||||
```
|
||||
|
||||
### Path Handling
|
||||
|
||||
The upload command includes smart path handling:
|
||||
|
||||
- **Normalization**: Automatically normalizes double backslashes (`C:\\\\Users` → `C:\Users`)
|
||||
- **Directory Detection**: If the path is a directory, automatically appends the filename from Mythic
|
||||
- **Full Path Resolution**: Uses `GetFullPathName` to resolve relative paths to absolute paths
|
||||
- **Error Handling**: Clear error messages for invalid paths, access denied, or directory issues
|
||||
|
||||
### Implementation Details
|
||||
|
||||
The upload system uses:
|
||||
- **Chunk Size**: 512KB per chunk (configurable in code)
|
||||
- **Base64 Decoding**: Chunk data is automatically decoded from base64 before writing
|
||||
- **Sequential Requests**: Agent requests chunks one at a time (1, 2, 3, ...)
|
||||
- **Artifact Reporting**: Automatically reports "File Write" artifact with file path
|
||||
|
||||
### Error Handling
|
||||
|
||||
The upload command handles various error scenarios:
|
||||
- **Invalid Path**: Returns error if path is invalid or malformed
|
||||
- **Directory as Path**: Detects and reports error if path is a directory without filename
|
||||
- **Access Denied**: Returns Windows error code if file cannot be created/written
|
||||
- **Path Not Found**: Returns error if parent directory does not exist
|
||||
|
||||
### Viewing Upload Artifacts
|
||||
|
||||
1. Navigate to your callback in the Mythic UI
|
||||
2. Click the **Artifacts** icon (fingerprint) in the top navigation
|
||||
3. Filter by "File Write" artifact type
|
||||
4. View all files that were uploaded, including file paths and timestamps
|
||||
|
||||
For more information, see the [Mythic File Upload documentation](https://docs.mythic-c2.net/customizing/hooking-features/action-upload).
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Development
|
||||
|
||||
### Project Structure
|
||||
|
||||
Reference in New Issue
Block a user